A. Field of the Invention
The present invention relates generally to privacy protection and, more particularly, to systems and methods that protect private information provided to a third party.
B. Description of Related Art
Electronic commerce ("eCommerce") has dramatically increased in recent years. Many server operators now have web sites on the Internet that users can access to seek out or research information, purchase or research goods and/or services, and communicate with other users, web sites, or services. In a typical commercial transaction, a user browses a vendor's catalog, selects a product, places an order for the product, and pays for the product, all electronically over the Internet.
In some conventional eCommerce systems, the server operator requests the user to provide confidential personal and/or corporate information, such as a name, address, telephone number, or account data, in order to proceed with the on-line transaction. The user transmits the confidential information to the server operator over the Internet. The server operator may then use the confidential information to complete the transaction.
In other conventional eCommerce systems, a growing number of transactions are performed across intranets and internets (including the Internet) by protocols or mechanisms other than the hypertext transfer protocol (http://). Such non-http-based transactions use a myriad of different protocols and languages to encode the information, including electronic data interchange (EDI), file transfer protocol (FTP), extensible markup language (XML) send and receive, standard generalized markup language (SGML), etc. Furthermore, transactions such as these use transport mechanisms with protocols other than, or built upon, transmission control protocol/Internet protocol (TCP/IP), such as internetwork packet exchange (IPX), Internet protocol security (IPSEC), Internet protocol version 6 (Ipv6), secure sockets layer (SSL), etc. Also, these non-Web-based transactions can occur as a result of interconnections between systems through a common language specified by a metalanguage (e.g., specified by XML) or through direct binary communication between systems (e.g., via distributed component object model (DCOM), common object request broker architecture (CORBA), or other distributed object, procedural, or client-server architectures).
Two problems that exist in conventional eCommerce systems pose a major concern to businesses and individuals. The first problem includes the risk of invasion of privacy imposed on a user (corporate or individual) seeking goods, services, and/or information. The user may provide personal information, such as a name or credit card number, corporate information, such as a corporate name or account data, or a combination of personal and corporate information to a server operator offering these goods, services, and/or information. The user, however, has no way of knowing whether the provided information will be kept secure by the server operator and not used in a manner against his wishes. For example, the user may provide his name and telephone number as part of a standard eCommerce transaction. In some cases, the server operator sells or trades the user's information to telemarketing services without the knowledge of the user or stores the information in an insecure manner that permits access by a third party.
In the case of business-to-business transactions, information on what the business is buying, what quality and quantity, from whom, and what the business is thinking of buying (as evidenced by research and browsing habits) constitutes critical confidential information to the business. The risk of interception or misuse of this information is as great or greater than that of other types of personal or corporate information.
The second problem involves the irritating, time-consuming, and generally repetitious data entry required for a user (corporate or individual) to open a new account or use an existing one. For example, to open a new account, the user must provide private information regarding the user or the business. Some server operators will store a user's private information on their server for subsequent transactions by the user. To set up the account, however, the user must enter the information manually. To use a previously-opened account, the user must go through a tedious and mistake-fraught process and recall a password which, if the user follows security doctrines, should be unique to each site the user visits.
As a result, a need has arisen for a mechanism to insure the security of private information provided to a third party. A need has also arisen for a simplified, expedited, and automated mechanism for providing such information.